Dear David et. al, I am affected by bug #471380 regarding the viewvc package. I have therefore created a patch that will help you update the debian subdirectory for this package. I am successfully using this patch on my machine at www.zap.org.au.
The patch updates the quilt files in debian/patches (and drops the 04_forbidden_files as it does not seem to be needed now). It also installs the (new) docs subdirectory into /usr/share/doc/viewvc and the (new) templates-contrib subdirectory into /usr/share/doc/viewvc/examples. Please apply this patch (or your own variant) as quickly as possible; alternatively, could someone with Debian developer privileges do an appropriate NMU? Yours truly, John Zaitseff -- John Zaitseff ,--_|\ The ZAP Group Phone: +61 2 9643 7737 / \ Sydney, Australia E-mail: [EMAIL PROTECTED] \_,--._* http://www.zap.org.au/ v
diff -ruN viewvc/upstream/1.0.3-2.1/debian/changelog viewvc/tags/1.0.5-0.1zg1/debian/changelog --- viewvc/upstream/1.0.3-2.1/debian/changelog 2008-01-24 14:16:10.000000000 +1100 +++ viewvc/tags/1.0.5-0.1zg1/debian/changelog 2008-03-26 15:11:56.000000000 +1100 @@ -1,3 +1,31 @@ +viewvc (1.0.5-0.1zg1) unstable; urgency=medium + + * New upstream release, packaged for the ZAP Group package repository + (Closes: #471380). This solves CVE-2008-1290, CVE-2008-1291 and + CVE-2008-1292. + * Updated the following files in the debian/patches subdirectory: + series + 02_py2html_activation + 101_viewvc-install_Debian_paths + 102_viewvc.conf_Debian_customization + * Updated debian/rules to install documentation in the docs directory + and example templates in templates-contrib. + + -- John Zaitseff <[EMAIL PROTECTED]> Wed, 26 Mar 2008 15:10:10 +1100 + +viewvc (1.0.4-0.1zg1) unstable; urgency=low + + * New upstream release, packaged for the ZAP Group package repository. + * Updated patches/101_viewvc-install_Debian_paths for this release. + + -- John Zaitseff <[EMAIL PROTECTED]> Wed, 30 Jan 2008 09:23:10 +1100 + +viewvc (1.0.3-2.1zg1) unstable; urgency=low + + * Imported the upstream package into the ZAP Group package repository. + + -- John Zaitseff <[EMAIL PROTECTED]> Thu, 24 Jan 2008 14:39:57 +1100 + viewvc (1.0.3-2.1) unstable; urgency=medium * Non-maintainer upload. diff -ruN viewvc/upstream/1.0.3-2.1/debian/patches/02_py2html_activation viewvc/tags/1.0.5-0.1zg1/debian/patches/02_py2html_activation --- viewvc/upstream/1.0.3-2.1/debian/patches/02_py2html_activation 2008-01-24 14:16:10.000000000 +1100 +++ viewvc/tags/1.0.5-0.1zg1/debian/patches/02_py2html_activation 2008-03-26 14:52:14.000000000 +1100 @@ -6,7 +6,7 @@ =================================================================== --- lib/viewvc.py.orig 2006-03-18 03:07:36.642984000 +0100 +++ lib/viewvc.py 2006-03-18 16:11:32.945884353 +0100 -@@ -1310,7 +1310,7 @@ +@@ -1343,7 +1343,7 @@ return MarkupPHP(cfg.options.php_exe_path, fp) markup_streamers = { diff -ruN viewvc/upstream/1.0.3-2.1/debian/patches/101_viewvc-install_Debian_paths viewvc/tags/1.0.5-0.1zg1/debian/patches/101_viewvc-install_Debian_paths --- viewvc/upstream/1.0.3-2.1/debian/patches/101_viewvc-install_Debian_paths 2008-01-24 14:16:10.000000000 +1100 +++ viewvc/tags/1.0.5-0.1zg1/debian/patches/101_viewvc-install_Debian_paths 2008-03-26 14:52:14.000000000 +1100 @@ -1,24 +1,24 @@ Index: viewvc-install =================================================================== ---- viewvc-install.orig 2006-03-22 01:42:02.038375982 +0100 -+++ viewvc-install 2006-03-22 01:42:11.060273474 +0100 -@@ -122,16 +122,15 @@ - - def SetOnePath(contents, var, value): +--- viewvc-install.orig 2008-01-29 17:39:15.000000000 +1100 ++++ viewvc-install 2008-01-29 17:46:51.000000000 +1100 +@@ -119,7 +119,7 @@ + """Replace instances of the variable VAR as found in file CONTENTS + with VALUE.""" pattern = re.compile('^' + var + r'\s*=\s*.*$', re.MULTILINE) - repl = '%s = r"%s"' % (var, os.path.join(ROOT_DIR, value)) + repl = '%s = r"%s"' % (var, value) - return re.sub(pattern, ReEscape(repl), contents) + return re.sub(pattern, _escape(repl), contents) + -- - def SetPythonPaths(contents): +@@ -128,8 +128,8 @@ if contents[:2] == '#!': shbang = '#!' + sys.executable - contents = re.sub('^#![^\n]*', ReEscape(shbang), contents) -- contents = SetOnePath(contents, 'LIBRARY_DIR', 'lib') -- contents = SetOnePath(contents, 'CONF_PATHNAME', 'viewvc.conf') -+ contents = SetOnePath(contents, 'LIBRARY_DIR', '/usr/lib/viewvc') -+ contents = SetOnePath(contents, 'CONF_PATHNAME', '/etc/viewvc/viewvc.conf') + contents = re.sub('^#![^\n]*', _escape(shbang), contents) +- contents = replace_var(contents, 'LIBRARY_DIR', 'lib') +- contents = replace_var(contents, 'CONF_PATHNAME', 'viewvc.conf') ++ contents = replace_var(contents, 'LIBRARY_DIR', '/usr/lib/viewvc') ++ contents = replace_var(contents, 'CONF_PATHNAME', '/etc/viewvc/viewvc.conf') return contents diff -ruN viewvc/upstream/1.0.3-2.1/debian/patches/102_viewvc.conf_Debian_customization viewvc/tags/1.0.5-0.1zg1/debian/patches/102_viewvc.conf_Debian_customization --- viewvc/upstream/1.0.3-2.1/debian/patches/102_viewvc.conf_Debian_customization 2008-01-24 14:16:10.000000000 +1100 +++ viewvc/tags/1.0.5-0.1zg1/debian/patches/102_viewvc.conf_Debian_customization 2008-03-26 14:52:14.000000000 +1100 @@ -2,7 +2,7 @@ =================================================================== --- viewvc.conf.dist.orig 2006-03-18 20:01:45.600335457 +0100 +++ viewvc.conf.dist 2006-03-18 20:02:00.577814991 +0100 -@@ -375,7 +375,7 @@ +@@ -419,7 +419,7 @@ # If %lang% occurs in the pathname, then the selected language will be # substituted. # diff -ruN viewvc/upstream/1.0.3-2.1/debian/patches/series viewvc/tags/1.0.5-0.1zg1/debian/patches/series --- viewvc/upstream/1.0.3-2.1/debian/patches/series 2008-01-24 14:16:10.000000000 +1100 +++ viewvc/tags/1.0.5-0.1zg1/debian/patches/series 2008-03-26 14:52:14.000000000 +1100 @@ -1,6 +1,6 @@ 01_separe_log_and_file -p0 02_py2html_activation -p0 03_robots_support -p0 -04_forbidden_files -p0 +#04_forbidden_files -p0 101_viewvc-install_Debian_paths -p0 102_viewvc.conf_Debian_customization -p0 diff -ruN viewvc/upstream/1.0.3-2.1/debian/rules viewvc/tags/1.0.5-0.1zg1/debian/rules --- viewvc/upstream/1.0.3-2.1/debian/rules 2008-01-24 14:16:10.000000000 +1100 +++ viewvc/tags/1.0.5-0.1zg1/debian/rules 2008-03-26 15:11:28.000000000 +1100 @@ -105,10 +105,10 @@ # dh_install --sourcedir=debian/tmp --fail-missing dh_install --sourcedir=debian/tmp --list-missing -X.pyc -X/mod_python/ dh_installchangelogs CHANGES - dh_installdocs + dh_installdocs docs dh_installdebconf dh_installman -# dh_installexamples + dh_installexamples templates-contrib dh_link dh_strip dh_compress